A clear-text password is a password that is stored or transmitted as readable text, without hashing or encryption. Anyone who can see the data, whether in a database, a log file, a backup or network traffic, can read the password directly. The terms plaintext password and unencrypted password mean the same thing.

Storing passwords this way is considered a serious security failing. If the system is breached, every affected account is exposed immediately, and because many people reuse passwords, the damage can spread to other services. Passwords should be stored as salted hashes made with a modern password hashing algorithm, and transmitted only over encrypted connections.

Clear-text passwords can appear unintentionally, for example in application logs, error messages, configuration files or support tickets. Discovering one in such a place is a reason to investigate, but it does not always mean a breach occurred, since it depends on who could access that data.

If you learn a password you use was exposed in clear text, change it everywhere you used it and enable multi-factor authentication. Service operators should hash passwords properly, scrub them from logs, search existing logs and backups for stored passwords, and rotate any credentials that were exposed.